Selectivity

In the DSM Editor, you can restrict running a custom property to certain criteria for better performance.

The following are the types of restrictions:

By high-level category and low-level category

A property is evaluated only when the high-level and low-level categories match a specific combination. For example, a property is evaluated only when the event is known to have a high-level category of Authentication and a low-level category of Admin Logout.

By specific QID

A property is evaluated only when the event that is seen maps to a specific QID. For example, when the event maps to a QID of Login Failed, the property is evaluated.